ask-user-questions — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ask-user-questions (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
When you (the agent) need clarifications, asking inline in chat is unreliable: long responses get skimmed, formats vary, and answers are lost in the conversation. Instead, you write a structured QCM markdown file grouped by theme. The user reviews it in their editor, marks their choices, optionally adds notes, saves. You re-read the file and continue.
This is more stable, traceable (the files live in .questions/, gitignored), and lets the user answer at their own pace without breaking flow. It also works well for batch-asking (e.g., a triage at the start of a phase).
Use it when:
Do NOT use it when:
CONTEXT.md, the codebase, or the recent conversation. Re-read first.If in doubt, prefer asking via this skill over guessing silently.
If .questions/ does not exist at the project root:
.questions/..questions/.gitignore with the single line * so the whole directory is ignored by git, but the directory itself can stay tracked. Alternative: add .questions/ to the project's root .gitignore. Pick whichever is cleaner..questions/CONTEXT.md and tell the user it exists. They can fill it with project-level info (stack, conventions, constraints) that you'll auto-read before composing every question. Don't fill it yourself unless asked.After setup, proceed normally.
Before composing questions, read .questions/CONTEXT.md if it exists. Use that information to:
Do not include the contents of CONTEXT.md in the question file. The user already knows what's there.
Prefer one file per batch of related questions rather than one file per question. Group by:
Q-phase1-triage, Q-sprint03-kickoff).Q-auth-design, Q-db-migrations).Q-deployment-stack).A file should contain between 2 and ~10 questions. Less than 2 is not really a batch — ask in chat. More than 10 means you're trying to make too many decisions at once — split into multiple files or rethink the scope.
If a single question is genuinely standalone and urgent, it's fine to make a one-question file.
Filename format: YYYY-MM-DD-slug.md where slug is a short kebab-case description of the topic.
Examples:
.questions/2026-04-25-phase1-triage.md.questions/2026-04-25-cache-strategy.md.questions/2026-04-25-sprint03-kickoff.mdIf a file with the same name already exists for today, append a short suffix: 2026-04-25-cache-strategy-2.md.
See templates/question.md for the canonical format and templates/example.md for a fully filled real example. The structure is:
---
id: Q-<derived-from-filename-slug>
phase: <prep | sprint01 | sprint02 | design | research | release | ...>
raised_by: <role(s) that need this answered, e.g. pm + architect>
raised_on: <YYYY-MM-DD>
references: [<component-or-file>, <component-or-file>, ...]
blocking_scope: <what is blocked: feature-DoR | sprint-kickoff | release | none>
---
# <Batch title — typically "<Phase or theme> — open questions">
Mark `[x]` on the option you want. `[-]` is the preselected recommendation; `[ ]` is an alternative. Add free-form notes under any question if needed.
---
## Q1 — <Question title>
Affects: `<component-or-file>`, `<component-or-file>`.
- [ ] <Option A — short label.> <Optional one-line tradeoff/comment.>
- [-] <Option B — short label.> <Optional one-line tradeoff/comment.> (recommended)
- [ ] <Option C — short label.> <Optional one-line tradeoff/comment.>
Notes:
---
## Q2 — <Question title>
Affects: `<component>`.
- [-] <Option A.>
- [ ] <Option B.>
Notes:
---
## Q<N> — Anything else?
Free-form. Things you want to flag that aren't in the list above.Every file MUST start with a YAML frontmatter block containing:
Q-. For 2026-04-25-phase1-triage.md → id: Q-phase1-triage. Drop the date prefix; keep just the slug.CONTEXT.md and recent conversation). Fall back to descriptive labels: prep, design, research, sprintNN, release.pm, architect, pm + architect, dev. This is who asks, not who answers.YYYY-MM-DD..architecture/ or similar to find the right names). Empty list [] is allowed only if truly nothing specific is referenced.feature-DoR, sprint-kickoff, release, none. If unsure, use none.If you don't know a value, do your best from context; don't leave fields out. The user will correct it if needed.
[x]), rejects it (turn it into [ ] and pick another), or writes notes.- [ ] Sequential ids — simpler, but two parses with reordered blocks produce diverging ids.Notes: (empty). The user fills it if they want.Notes:.Q<N> — Anything else? with free-form prose only (no options, no Notes: sub-label since the whole question is freetext).If a question must be answered before a specific milestone (sprint kickoff, release, etc.), add a sentence in the question body like:
This is a planning blocker — needs an answer before SPRINT_001 kickoff.
This is in addition to blocking_scope in the frontmatter — it makes the urgency visible inline.
After creating the file, send a short message in chat:
I've created.questions/2026-04-25-phase1-triage.mdwith N questions. Recommendations are marked[-]. Edit the file, mark your choices with[x], and let me know when done.
Do not paste the file content in chat — it's redundant and the user will read it in their editor.
Stop work that depends on the answers. You may continue independent work, but be explicit about what you're doing while waiting.
When the user signals they've answered (or when you re-check):
A question is answered when none of its options is `[-]` anymore. That is: every [-] has been replaced by [x] (chosen) or [ ] (rejected).
The whole file is complete when all questions are answered as defined above. The final "Anything else?" question has no options — it's complete by virtue of the user having signaled done.
If any [-] remains, the file is still pending. Do not act on partial answers unless the user explicitly tells you to.
For each question:
- [x]. Usually one, but multi-select is allowed if the question asked for it.Notes: content: everything between Notes: and the next --- separator. Trim whitespace. If empty, treat as no notes.If the user wrote in Notes: but didn't tick any option, the notes ARE the answer — read carefully.
If the user ticked an option AND added notes, treat the notes as additional context or nuance on top of the choice.
For Q<N> — Anything else?: read everything between the heading and end of file (or next ---) as freetext.
The file stays in .questions/. Since the directory is gitignored, it doesn't pollute the repo. Don't delete it — it's a local record.
[x], add their words to Notes:) so the record stays consistent.phase: design, blocking_scope: none) rather than omitting the field.If .questions/CONTEXT.md exists, read it before composing every question file. It typically contains:
references and component namesNever write to CONTEXT.md yourself. It's the user's file. You may suggest additions in chat if you notice you're being asked the same thing across multiple sessions.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.